What is the CVSS score of CVE-2025-68876?

CVE-2025-68876 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-68876

HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-12-29 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.1 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 29, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in INVELITY Invelity SPS connect invelity-sps-connect allows Reflected XSS.This issue affects Invelity SPS connect: from n/a through <= 1.0.8.

AnalysisAI

Reflected cross-site scripting (XSS) in INVELITY Invelity SPS connect WordPress plugin through version 1.0.8 allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during web page generation and carries an extremely low exploitation probability (EPSS 0.04th percentile), suggesting minimal real-world attack motivation despite the CVSS scoring absence.

Technical ContextAI

This is a classic reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) affecting the Invelity SPS connect WordPress plugin. The plugin fails to properly sanitize or validate user-supplied input before echoing it back in HTTP responses, allowing attackers to craft malicious URLs containing arbitrary HTML and JavaScript that execute in the browser context of victims who click the link. WordPress plugins are particularly prone to such flaws when they process query parameters or form data without adequate escaping functions like esc_attr(), esc_js(), or wp_kses_post(). The vulnerability is reflected (not stored), meaning the payload must be delivered to the target via a crafted URL rather than persisting in the application database.

Affected ProductsAI

INVELITY Invelity SPS connect WordPress plugin versions up to and including 1.0.8 are affected by this reflected XSS vulnerability. The plugin is distributed through the WordPress plugin repository (referenced via patchstack.com database link). No specific CPE string is provided in available data, but the affected component is identifiable as the WordPress plugin with slug 'invelity-sps-connect'.

RemediationAI

Update the Invelity SPS connect plugin to a patched version released after 1.0.8. Check the WordPress plugin repository or the vendor's advisory at https://patchstack.com/database/Wordpress/Plugin/invelity-sps-connect/vulnerability/wordpress-invelity-sps-connect-plugin-1-0-8-reflected-cross-site-scripting-xss-vulnerability for the specific fixed version number. If an update is not yet available, disable or remove the plugin until a patch is released. Site administrators should verify the plugin's purpose aligns with their needs before re-enabling it post-patch, and audit any user input handling in custom code for similar XSS issues.